Make the Key Connector admin exemption configurable

Owners and admins no longer get the connector advertised by default
(KEY_CONNECTOR_EXEMPT_ADMINS=true), so clients ask them for a master
password instead of enrolling them. Setting it to false advertises it
to them as well. Users already enrolled keep unlocking through the
connector either way.

src/api/identity.rs

@@ -30,9 +30,9 @@ use crate::{
     db::{
         DbConn,
         models::{
-            AuthRequest, AuthRequestId, Device, DeviceId, EventType, Invitation, OIDCCodeResponseError,
+            AuthRequest, AuthRequestId, Device, DeviceId, EventType, Invitation, Membership, MembershipType,
-            OrganizationApiKey, OrganizationId, SendId, SsoAuth, SsoUser, TwoFactor, TwoFactorIncomplete,
+            OIDCCodeResponseError, OrganizationApiKey, OrganizationId, SendId, SsoAuth, SsoUser, TwoFactor,
-            TwoFactorType, User, UserId,
+            TwoFactorIncomplete, TwoFactorType, User, UserId,
         },
     },
     error::MapResult,
@@ -597,8 +597,13 @@ async fn authenticated_response(
     // Also advertised to users without a master password, that is how the client
     // knows to enroll a new SSO user with the connector
     if CONFIG.key_connector_enabled() && !has_master_password {
-        result["UserDecryptionOptions"]["KeyConnectorOption"] =
+        let advertise = uses_key_connector
-            crate::api::core::key_connector::key_connector_user_decryption_option();
+            || !CONFIG.key_connector_exempt_admins()
+            || !Membership::find_by_user(&user.uuid, conn).await.iter().any(|m| m.atype >= MembershipType::Admin);
+        if advertise {
+            result["UserDecryptionOptions"]["KeyConnectorOption"] =
+                crate::api::core::key_connector::key_connector_user_decryption_option();
+        }
     }
 
     if let Some(token) = twofactor_token {

src/config.rs

@@ -805,6 +805,8 @@ make_config! {
         key_connector_url:              String, true,   def,    String::new();
         /// Key Connector org name |> Name shown in the client's domain-confirmation dialog
         key_connector_org_name:         String, true,   def,    String::from("Key Connector");
+        /// Key Connector exempt admins |> Do not advertise the Key Connector to owners and admins so they set a master password instead. Users already enrolled keep using key connector
+        key_connector_exempt_admins:    bool,   true,   def,    true;
         /// Only SSO login |> Disable Email+Master Password login
         sso_only:                       bool,   true,   def,    false;
         /// Allow email association |> Associate existing non-SSO user based on email